Exploit for OS Command Injection in Cacti

Cacti v1.2.24 authenticated command injection CVE-2023-39362...

CVE-2023-36816: Improper Neutralization of Input During Web Page Generation

2FA is a Web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Cross site scripting XSS injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3...

Critical Photon OS Security Update - PHSA-2023-4.0-0417

Updates of 'bindutils', 'libXi', 'protobuf', 'samba-client', 'libarchive', 'kube-bench', 'docker-compose', 'libtiff', 'binutils-aarch64-linux-gnu', 'nodejs', 'binutils', 'ntp' packages of Photon OS have been released...

Debian: Security Advisory (DLA-3473-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-34844

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

CVE-2023-34844

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

Code injection

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

[SECURITY] [DLA 3473-1] docker-registry security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3473-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès June 29, 2023 https://wiki.debian.org/LTS -...

CVE-2023-34844

CVE-2023-34844 affects Play With Docker, where versions prior to 0.0.2 expose an insecure CAP_SYS_ADMIN privileged mode allowing a container escape. The root cause is improper privilege handling that enables elevation from within a container to host context. Documented impact is privileged escape...

CVE-2023-34844

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

CVE-2023-34844

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

Play With Docker security vulnerabilities

Play With Docker is an easy, interactive and fun training ground for learning Docker. A security vulnerability exists in Play With Docker versions prior to 0.0.2 that stems from having an insecure CAPSYSADMIN privilege pattern that causes Docker containers to escape...

CVE-2023-34844

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

CVE-2023-34844: Improper Check for Dropped Privileges

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

CVE-2023-34844

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

DLA-3473-1 docker-registry - security update

Bulletin has no description...

Debian dla-3473 : docker-registry - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3473 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3473-1 [email protected] https://www.debian.org/lts/security/...

Mageia: Security Advisory (MGASA-2023-0207)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Terraform Enterprise, Docker Engine, and Go’s CVE-2023-24540

Summary Up until June 2023, Docker Engine 20.10 was the highest release officially supported by Terraform Enterprise TFE. However, that version is no longer supported by Docker and was built using a version of Go that has since had a number of CVEs disclosed. While these CVEs are unlikely to be...

ownCloud: Cross-Site Request Forgery

A cross-site request forgery vulnerability was found in an application. Requests were not validating cross-site request forgery tokens, allowing an unauthorized user to perform administration functions by inserting valid session cookies into arbitrary requests. This could have enabled an attacker...